Inside a Phish

While responding to a phishing campaign, the phishing kit and corresponding blind drop email address were discovered. Law enforcement executed a search warrant with the Internet Service Provider on the email address, which turned out to hold a surprising amount of information. Several years later, permission was received by the author to review the emails. This paper examines the events of that phish with the insights gained from the phisher's own email and information from the targeted financial institution.